SecondFi Wallet Flaw Tied to 16M ADA; EMURGO Exits Pentad

An exploit of SecondFi’s wallet address‑generation system compromised custody tied to about 16 million ADA across 374 wallets, according to on‑chain reconstruction. Forensic analysis also identified broader on‑chain movements that exceed 129 million ADA; investigators distinguish those larger sweeps from the confirmed losses linked to affected users.

Bitquery’s forensic work traced the technical failure to weak randomness in SecondFi’s key‑generation code. The Cardano ledger recorded and processed the resulting transactions normally; public records attribute the incident to compromised custody at the wallet layer rather than a failure of Cardano’s ledger or consensus.

EMURGO, a founding Cardano entity and member of Pentad, announced it would step down from the five‑member treasury coordination group to concentrate resources on recovering funds, migrating users to safer custody, and designing an on‑chain restitution process. Pentad brings together Input Output, the Cardano Foundation, EMURGO, Intersect and the Midnight Foundation to coordinate infrastructure spending. EMURGO did not confirm whether the step back is permanent. The remaining Pentad members will continue coordinating existing funding rounds.

Cardano’s governance model starts at the wallet under CIP‑1694. Wallet documentation for governance‑compatible clients links delegation, reward withdrawal and direct voting flows to actions taken inside the wallet, and GovTool connections are routed through the wallet flow. CardanoCube’s governance hub recorded 28 active governance actions, 379 active delegated representatives and 3,217 votes cast over a 30‑day window, with 87.52 billion ADA in voting power exercised in that period. Measured against that 30‑day voting activity, the confirmed custody loss of about 16 million ADA equals roughly 0.018% of cumulative voting power over the month.

The network previously approved a 70 million ADA Critical Integrations budget in late 2025 to address gaps in stablecoins, custody, cross‑chain bridges, oracles and analytics. In May 2026 the Cardano Foundation routed a 23 million ADA Year‑2 Critical Integrations V2 funding request through Pentad, listing the Foundation, Input Output, EMURGO and Midnight as co‑sponsors and Intersect as administrator. EMURGO’s withdrawal comes while that funding round remains active and reduces the number of coordinating parties.

Investigators report the exploit concentrated harm at the individual holder level; the confirmed loss averages about 42,800 ADA per affected wallet. For now, public records and forensic reports keep the failure localized to the wallet layer and identify weak key randomness as the initial cause.